Short answer
Yes. With FirstNet's FortiAnalyzer as a Service (FAZaaS), logs are held on FirstNet-run systems in South Africa and, in normal service, stay there. FirstNet carries the job of running the platform, but under POPIA you remain the responsible party.
In detail
How the roles split:
- FirstNet: runs the hosted platform, including patching, backups, upgrades and capacity monitoring.
- You: your duties to data subjects and your internal governance stay the same.
- Exceptions: backup locations, support workflows and any other exception paths follow the governing service terms and service description.
This applies to FAZaaS only. If you buy FortiAnalyzer Cloud directly from Fortinet, it is typically hosted in US or EU regions. Your compliance review must then take cross-border data into account. If you host FortiAnalyzer yourself, the hosting and the running of it stay with you.
For regulated organisations in financial services, the public sector, education and healthcare, three things are often decisive. These are South African hosting, rand billing and a FirstNet-run model. FirstNet reviews formal compliance wording or questionnaires before making any commitment.
Source: FirstNet Hosted Firewall & Network Security service page →
Didn’t answer your question?